8ae576123f81bfexeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8ae576123f81bfexeexeexeex.exe
Size 2.1MB
Sample230708-vt18bsgb72
SHA256 3eecb01f52352efd6c03f7dfce0e0e1ce8b9bd8e00662c666f34c389454ce050
MD5 8ae576123f81bf4e2a0d7267e81e19f1
SHA1 f0e77fc777ef3d4539ebe5b171492d0d627a448a
SHA512 52d52ff7327f50c5f7e03c560b118015d3188ddc460f092d082b5c10afa56263544b79cf0fff590f96702d6312ad877d8d5265200e1c35fa1eb0346d8dace1bd
SSDEEP 49152:JPt4jtUXQDNdx9ohBw+S3B3zDIhuhVvj/VHYsh3ANkTTl:0UXQDNdx9iSBFVvjhl3AM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ae576123f81bfexeexeexeex.exe

File Explorer

8ae576123f81bfexeexeexeex.exe

.exe 2.1MB

8ae576123f81bfexeexeexeex.exe

IMPHASH fcdcf4239ade4bb66e6f89d5914ca08e
SHA256 3eecb01f52352efd6c03f7dfce0e0e1ce8b9bd8e00662c666f34c389454ce050
MD5 8ae576123f81bf4e2a0d7267e81e19f1
SHA1 f0e77fc777ef3d4539ebe5b171492d0d627a448a
SHA512 52d52ff7327f50c5f7e03c560b118015d3188ddc460f092d082b5c10afa56263544b79cf0fff590f96702d6312ad877d8d5265200e1c35fa1eb0346d8dace1bd
SSDEEP 49152:JPt4jtUXQDNdx9ohBw+S3B3zDIhuhVvj/VHYsh3ANkTTl:0UXQDNdx9iSBFVvjhl3AM
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317472

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose DeleteFileA VirtualFree GetEnvironmentVariableA VirtualAlloc CreateFileMappingA SetFileTime GetFileAttributesA GetFileAttributesW ReadFile CreateFileW lstrcatA DeviceIoControl lstrcpyW SetLastError GetComputerNameA FindResourceA FreeResource LoadResource WaitForSingleObject GetProcessHeap GetSystemWow64DirectoryA SizeofResource CreateEventA CreateProcessA GetSystemDirectoryA ResetEvent GetLocalTime GetExitCodeThread LockResource GetSystemInfo WinExec FreeLibrary IsBadReadPtr LoadLibraryA VirtualProtect GetModuleHandleW GetSystemDirectoryW LoadLibraryW GetCurrentThreadId InterlockedIncrement ExpandEnvironmentStringsA LocalAlloc ResumeThread SetFilePointer SystemTimeToFileTime CreateDirectoryA GetCurrentDirectoryA LocalFileTimeToFileTime GetDriveTypeA GetPrivateProfileStringA GetFileSize WaitNamedPipeW ReadProcessMemory SetNamedPipeHandleState VirtualFreeEx VirtualAllocEx SleepEx lstrlenW CreateProcessW WriteProcessMemory VirtualProtectEx lstrcpyA GetVersionExW GetCurrentDirectoryW GetModuleFileNameW GetVersion VirtualQueryEx GetCurrentThread CreateRemoteThread GetWindowsDirectoryW CreateFileMappingW CreateMutexW OpenMutexW OpenFileMappingW CreateEventW OpenEventW ExitThread FlushInstructionCache ReleaseMutex GetThreadContext InterlockedCompareExchange SetEndOfFile GetDriveTypeW SetEnvironmentVariableA CompareStringW GetTimeZoneInformation InterlockedExchange GetStringTypeW GetFullPathNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers LocalFree FormatMessageA GetTickCount lstrlenA FileTimeToLocalFileTime CreateToolhelp32Snapshot Process32Next lstrcmpiA FileTimeToSystemTime GetProcessTimes Process32First WriteFile WaitNamedPipeA GetSystemTime OpenFileMappingA GetCurrentProcessId CloseHandle CreateMutexA GetModuleHandleA GetModuleFileNameA GetProcAddress GetLastError MultiByteToWideChar TerminateProcess Sleep WideCharToMultiByte OpenProcess FlushViewOfFile UnmapViewOfFile MapViewOfFile CreateFileA ExitProcess OutputDebugStringA DeleteCriticalSection AddVectoredExceptionHandler EnterCriticalSection HeapCreate LeaveCriticalSection InitializeCriticalSection HeapFree GetCurrentProcess HeapAlloc VirtualQuery LCMapStringW GetConsoleMode GetConsoleCP GetStartupInfoW SetHandleCount InitializeCriticalSectionAndSpinCount SetStdHandle HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind FindFirstFileExA HeapSetInformation GetCommandLineA HeapReAlloc GetStdHandle WriteConsoleW GetFileType PeekNamedPipe GetFileInformationByHandle MoveFileA CreateThread DecodePointer EncodePointer GetSystemTimeAsFileTime DuplicateHandle

user32

GetThreadDesktop GetUserObjectInformationA OpenInputDesktop wsprintfA CharNextA GetParent EnumWindows PeekMessageA GetSystemMetrics GetWindowThreadProcessId GetMessageA TranslateMessage DispatchMessageA CloseDesktop

advapi32

OpenSCManagerA InitializeSecurityDescriptor SetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid FreeSid GetTokenInformation LookupPrivilegeValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyW RegDeleteKeyW CreateServiceW OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus ChangeServiceConfigW StartServiceW ControlService OpenProcessToken QueryServiceStatusEx StartServiceA CreateServiceA EnumDependentServicesA DeleteService CloseServiceHandle OpenServiceA RegDeleteValueA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegOpenKeyA BuildExplicitAccessWithNameA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA SetNamedSecurityInfoA SetEntriesInAclA AdjustTokenPrivileges LookupPrivilegeValueA

shell32

ShellExecuteExA SHFileOperationA

shlwapi

PathIsDirectoryA PathIsRootA PathFindFileNameA PathStripToRootA PathFileExistsA PathRemoveFileSpecA PathAddBackslashA

psapi

GetMappedFileNameA

ws2_32

getsockname htons inet_addr connect gethostname WSACleanup WSAStartup WSAGetLastError recv send socket ntohs bind getsockopt getpeername WSASetLastError freeaddrinfo getaddrinfo __WSAFDIsSet select ioctlsocket closesocket setsockopt gethostbyname

imagehlp

CheckSumMappedFile

iphlpapi

GetAdaptersInfo

Name

.text

Size

995KB

Virtual Size

994KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cpp0

Size

577KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ